Keep journal recovery snapshots and audit backups outside the synced vault

[levineam]

Motivation

• Prevent sensitive deleted/redacted journal contents from being persisted under the user vault where sync/index/export tools (or other vault readers) can leak them.
• Provide a secure, local-only location for full-content known-good snapshots and audit backups that is isolated per vault.

Description

• Move journal recovery state out of the vault: snapshots and audit backups now live under an OS-local state area (default: XDG_STATE_HOME or ~/.local/state/jarvos/journal-maintenance/<vaultId>), and can be overridden with JARVOS_JOURNAL_STATE_DIR.
• Add migrateLegacyJournalSnapshots(journalDir) to copy legacy .jarvos/journal-maintenance state into the local state area and remove the synced copies to avoid leaving secret data in the vault.
• Harden file and directory permissions: state directories are created with 0700 and state/snapshot/backup files are written with 0600; migrated copies are chmod'd accordingly.
• Ensure migration runs on normal (non-dry-run) maintenance runs via syncOneDate, and update known-good/audit write paths to use secure modes.
• Update tests to use an isolated per-test local-state directory and add a regression test asserting that legacy snapshots are moved out of the vault, backups/restores still work, and new files have restrictive permissions.
• Files changed: modules/jarvos-secondbrain/packages/jarvos-secondbrain-journal/src/journal-maintenance.js and test updates under modules/jarvos-secondbrain/tests/.

Testing

• Ran the journal test suites: node --test modules/jarvos-secondbrain/tests/journal-stub-guard.test.js modules/jarvos-secondbrain/tests/journal-maintenance.test.js modules/jarvos-secondbrain/tests/journal-projects-section.test.js and all tests passed (54 tests, 0 failures).
• Confirmed the new migration and permission behavior via the added regression test that seeds legacy copies inside a temporary vault, runs maintenance, and asserts migrated files exist outside the vault, legacy synced copies are removed, restore occurred, and resulting files are mode 0600 (test succeeded).
• Ran basic repo checks (git diff --check) with no remaining whitespace/patch issues.

---

Codex Task